What Is an Image Tag? Naming and Versioning Images

An image tag is a readable label on a repository - myapp:1.4 - that points to a specific image but can be moved to point at a different one later.

Tags are how humans refer to images. The full reference combines repository and tag, like ghcr.io/acme/web:1.4. Because tags are just movable pointers, your tagging strategy quietly determines how predictable and traceable your deploys are.

Anatomy of a reference

A reference is [registry/]repository:tag. If you omit the tag, Docker assumes latest. The tag is a label on the repository, not part of the image content - which is why it can be repointed.

The trouble with latest

latest is just a conventional tag, not "the newest" - it points wherever it was last pushed. Relying on it makes deploys non-reproducible, because the bits behind latest can change without notice.

Tagging strategies

Semantic versions (1.4.0) for releases.
Git SHA tags (sha-abc123) for exact traceability to a commit.
Environment tags (staging, prod) as movable pointers to a release.

Tags vs digests

A tag is convenient but mutable; a digest is immutable. A common pattern is to tag for humans and deploy by digest for guarantees.

Tagging in CI

Pipelines usually tag each build with both a version and the commit SHA, then push. The SHA tag ties a running image back to the exact code, which is invaluable when debugging a deploy.

Key takeaways

A tag is a movable, human-readable label on a repository.
latest means "last pushed", not "newest" - avoid relying on it.
Tag releases with versions and commit SHAs for traceability.